Discussion on: What dev topic do you think you should understand, but don't?

I think I'm with you. I'd bring the whole auth service thing back to trust in this case.

Let me put this on a spectrum. What we're talking about is trusting that someone is who they claim they are.

1. Radio button that chooses between admin and non-admin
2. A list of users that they choose from
3. A magic user name, email, or key that they have to enter
4. User/Pass combination
5. Log-In Service (eg: Google. Your service is known to google, and tells your service, "Hey, I know who this person is, here")

At the end of the day each one of these makes a claim about who they are. Each one (Hopefully) instills more trust than the one before.

When you use something like Auth0, or Google, or Github to log in, you're essentially saying, "Look, I trust that you solved this problem of knowing who people claim they are, so you tell me who they are and I'll consider that good"

The mechanics of this often obfuscate this, because there's a lot of back and forth. That's part of the dance of trust. Each step in the mechanisms exists to prohibit untrusted sources from getting through.